Documentation
AuditPolicy Overview
When to use AuditPolicy and what it covers.
Use AuditPolicy when Windows audit policy state needs to be inspected, backed up, restored, or changed from PowerShell.
It is most useful for repeatable workstation or server checks where auditpol.exe, Local Security Policy, and Group Policy interactions need to be handled deliberately.
Common tasks
- Review current audit policy settings by category or policy name.
- Back up local audit policy before making changes.
- Restore a saved policy file in a controlled maintenance window.
- Test changes with
-WhatIfbefore applying them.